Collecting and processing personal data when the subject remains silent shall be fined up to 70 million VND

This content is stipulated in Decree No. 330/2026/ND-CP of the Government on sanctioning administrative violations in the field of network security and personal data protection (DLCN).

Regarding violations of regulations on the consent of DLCN subjects, the Decree stipulates:

1. A fine of between VND 30,000,000 and VND 50,000,000 shall be imposed for one of the following acts:

- Handling DLCN after collection without the consent of the DLCN owner, unless otherwise provided by law;

- Attached to mandatory conditions, refusal to provide services if the employer does not agree to handle employers for other purposes not related to the content of the service provision agreement;

- Establishing the default agreement method, creating unclear instructions, causing misunderstandings between agreement and disagreement for the DLCN chủ thế;

- The request for consent is not expressed in a clear and specific manner, not ensuring the ability to verify the determination of the occupational status of DLCN that has implemented the consent, time and content agreed upon;

- Failure to provide DLCN subjects with transparent information about the type of DLCN being processed, the purpose of DLCN processing, the rights and obligations of DLCN subjects, controlling parties or controlling and processing DLCN parties leading to consent not based on voluntariness and clear knowledge;

- The form of asking for consent does not guarantee that the DLCN entity is agreed upon with each purpose of handling DLCN;

- Not recording, not keeping a logbook about the consent of the DLCN entity, not proving that there was consent when requested by the DLCN entity or requested for inspection and examination by a competent state agency;

- Not informing the DLCN entity that their sensitive DLCN is being handled.

2. A fine of between 50,000,000 VND and 70,000,000 VND shall be imposed for one of the following acts:

- Deliberately continuing to handle DLCN after the DLCN entity has requested to stop or limit handling or when a competent state agency requests in writing;

- Collect and handle DLCN when the DLCN entity remains silent or does not respond to the request for consent, arbitrarily considering silence as consent.

3. Additional form of sanction: Confiscation of exhibits and means of administrative violation.

4. Remedial measures: Forcing the cancellation or deletion to the point where it is impossible to restore DLCN collected and processed without valid consent for the violation; forcing the return of illegal revenue obtained from the violation in Clause 2 of this Article.

This Decree takes effect from August 19, 2026.

Read the original here